fix(install): consumer-install-hardening S3 V2 — runtime-discipline arming WARN - #491
Merged
Conversation
…rming WARN (@opentelemetry detect) Symmetric to #486's V1 glob-liveness gate: V1 catches "rule armed but covers nothing"; V2 catches "infra matured but rule still disarmed". On install, if the consumer package.json already lists @opentelemetry/* but AIF_STRICT_RUNTIME is unset, R8 (require-otel-span) silently never fires — surface a non-fatal WARN (exit 0). Greps package.json TEXT (deps may be uninstalled at install time → no module check). Ships the §4.6-approved V2 that #486/#490 did not include. - install.sh: + arming-WARN block (before Done; --dry-run-aware) - tests/install-sh/v2-strict-runtime-armed.test.sh: paired-negative probe - .github/workflows/audit-self.yml: + wired CI step Prior-art: skipped — install-time WARN + 1 test probe, no new dependency / no code module ≥50-80 LOC under packages/ → not a capability commit.
artyhoo
added a commit
that referenced
this pull request
Jun 13, 2026
#495) * chore(orchestrator): close final-quality-audit umbrella (done.md) + §0 reconcile The FQA umbrella shipped S1–S3 in #470 (de-inert shipped quality gates + principle-15 git-aware + orphan deletions + doc-currency; DN-1..DN-4 resolved within S3) but was never formally closed and is absent from wave-sequencing-plan §0. /pipeline final-quality-audit plan-currency check surfaced the drift. - Write the missing `.claude/orchestrator-prompts/final-quality-audit/done.md` closure marker (Final PR #470). Executable closure evidence: `tests/install-sh/c1-wiring.test.sh` 10/10 incl. P1-neg/P1-pos paired-negative. - Reconcile §0 → 2026-06-13: add the FQA umbrella row + its `consumer-install- hardening` follow-on (✅ #491/#493); mark `guard-liveness` ✅ DONE (#484/#489) — all three were the 2026-06-11 open frontier, all closed today. - Rewrite open-frontier + «What actually remains» to «no active in-flight umbrella»; bump snapshot date + add revision-history entry. Prior-art: skipped — orchestrator bookkeeping (done.md closure marker + §0 plan reconciliation reflecting already-merged PRs), no new capability. * fix(orchestrator): full filename in FQA done.md (basename -f crash in dead-link check) The done.md referenced the S2 plan as shorthand `-fqa-s2-consolidation-plan.md` with a leading dash. audit-self.yml:104 dead-link check runs `basename "$ref"`, which parses a leading-dash arg as a flag → `basename: invalid option -- 'f'` → mechanical-checks job exit 1 → ci-success fails. Use the full filename `2026-06-11-fqa-s2-consolidation-plan.md` (also resolves the dead-link warning, since that file exists). Prior-art: skipped — one-line doc fix, no new capability. --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ships the §4.6-approved V2 that S3 (#486 globs + #490 F14) did not include: a consumer-side install-time WARN that catches "infra matured but rule still disarmed."
Symmetric to #486's V1 glob-liveness gate:
package.jsonalready lists@opentelemetry/*yetAIF_STRICT_RUNTIMEis unset, R8 (require-otel-span) silently never fires. V2 surfaces that as a non-fatal WARN (exit 0).Greps the
package.jsontext (deps may be uninstalled at install time → no module/require check). Honest scope: OTel-dep signal only (mechanically reliable); the R7 Clock/Random heuristic is documented-future, not implemented.Changes (additive only — rebased on current
staginga4b87134, no overlap with #486/#490)install.sh— arming-WARN block (before the Done section;--dry-run-aware).tests/install-sh/v2-strict-runtime-armed.test.sh— paired-negative probe (otel+unset → WARN; otel+armed=1 → silent; no-otel → silent; install exit 0 in all legs)..github/workflows/audit-self.yml— wired CI step.Verify-trace
a4b87134, post-fix(install): consumer-install-hardening S3 (globs) — F3/F5/F7 layout-agnostic rule scoping + V gate + F15 #486/fix(install): consumer-install-hardening S3 follow-up — F14 lint-staged binary-resolution (monorepo ENOENT) #490) — confirmed V2 absent on staging before this PR (no clobber; append-merge touched only the 3 V2 paths).bash -n install.shclean; WARN block exercised in isolation —otel+unset → WARN,otel+armed=1 → silent,no-otel → silent.audit-self.ymlYAML-valid; V2 probe wired exactly once.audit-self→ v2-strict-runtime-armed) — to confirm on the CI run (local full-install needs the staging template set).Scope
Net-new only. F3/F5/F7/F14/F15/V1 are already merged (#486/#490) and untouched here. Not a capability commit (no new dep / no code module ≥50-80 LOC under
packages/).